Charles BochetandGitHub
191a277ddf
## Summary ### Cache invalidation fix - After migrating object/field permissions to syncable entities (#18609, #18751, #18567), changes to `flatObjectPermissionMaps`, `flatFieldPermissionMaps`, or `flatPermissionFlagMaps` no longer triggered `rolesPermissions` cache invalidation - This caused stale permission data to be served, leading to flaky `permissions-on-relations` integration tests and potentially incorrect permission enforcement in production after object permission upserts - Adds the three permission-related flat map keys to the condition that triggers `rolesPermissions` cache recomputation in `WorkspaceMigrationRunnerService.getLegacyCacheInvalidationPromises` - Clears memoizer after recomputation to prevent concurrent `getOrRecompute` calls from caching stale data ### Docker Hub rate limit fix - CI service containers (postgres, redis, clickhouse) and `docker run`/`docker build` steps were pulling from Docker Hub **unauthenticated**, hitting the 100-pull-per-6-hour rate limit on shared GitHub-hosted runner IPs - Adds `credentials` blocks to all service container definitions and `docker/login-action` steps before `docker run`/`docker compose` commands - Uses `vars.DOCKERHUB_USERNAME` + `secrets.DOCKERHUB_PASSWORD` (matching the existing twenty-infra convention) - Affected workflows: ci-server, ci-merge-queue, ci-breaking-changes, ci-zapier, ci-sdk, ci-create-app-e2e, ci-website, ci-test-docker-compose, preview-env-keepalive, spawn-twenty-docker-image action
77 lines
2.2 KiB
YAML
77 lines
2.2 KiB
YAML
name: CI Website
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
pull_request:
|
|
merge_group:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
|
|
|
|
jobs:
|
|
changed-files-check:
|
|
if: github.event_name != 'merge_group'
|
|
uses: ./.github/workflows/changed-files.yaml
|
|
with:
|
|
files: |
|
|
package.json
|
|
packages/twenty-website/**
|
|
website-build:
|
|
needs: changed-files-check
|
|
if: needs.changed-files-check.outputs.any_changed == 'true'
|
|
timeout-minutes: 10
|
|
runs-on: ubuntu-latest
|
|
services:
|
|
postgres:
|
|
image: twentycrm/twenty-postgres-spilo
|
|
credentials:
|
|
username: ${{ vars.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
|
env:
|
|
PGUSER_SUPERUSER: postgres
|
|
PGPASSWORD_SUPERUSER: postgres
|
|
ALLOW_NOSSL: 'true'
|
|
SPILO_PROVIDER: 'local'
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd pg_isready
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 5
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 10
|
|
|
|
- name: Install dependencies
|
|
uses: ./.github/actions/yarn-install
|
|
|
|
- name: Server / Create DB
|
|
run: PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
|
|
|
|
- name: Website / Run migrations
|
|
run: npx nx database:migrate twenty-website
|
|
env:
|
|
DATABASE_PG_URL: postgres://postgres:postgres@localhost:5432/default
|
|
- name: Website / Build Website
|
|
run: npx nx build twenty-website
|
|
env:
|
|
DATABASE_PG_URL: postgres://postgres:postgres@localhost:5432/default
|
|
KEYSTATIC_GITHUB_CLIENT_ID: xxx
|
|
KEYSTATIC_GITHUB_CLIENT_SECRET: xxx
|
|
KEYSTATIC_SECRET: xxx
|
|
NEXT_PUBLIC_KEYSTATIC_GITHUB_APP_SLUG: xxx
|
|
ci-website-status-check:
|
|
if: always() && !cancelled()
|
|
timeout-minutes: 5
|
|
runs-on: ubuntu-latest
|
|
needs: [changed-files-check, website-build]
|
|
steps:
|
|
- name: Fail job if any needs failed
|
|
if: contains(needs.*.result, 'failure')
|
|
run: exit 1
|